Security Program Analysis GSTRT Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A non-profit organization that provides legal aid to vulnerable populations has a strong value of confidentiality. The organization is considering moving its case management system to a cloud provider to reduce costs. The current security program has no cloud experience and relies on on-premises servers. The board is concerned about client confidentiality. What should the security team recommend?

   • AMove to the cloud but only store non-sensitive data there
   • BConduct a detailed risk assessment and select a cloud provider with strong encryption and compliance certifications
   • CMove to the cloud because it is generally more secure than on-premises
   • DStay on-premises because the cloud cannot meet confidentiality requirements
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A manufacturing company is experiencing rapid growth and plans to double its workforce and expand into new international markets. The security team is updating the security program analysis. Which factor should be prioritized when forecasting future security needs?

   • AThe security team's preferred technology vendors.
   • BThe increased attack surface from new employees, devices, and international data flows.
   • CThe current security budget as a percentage of revenue.
   • DThe historical number of security incidents over the past five years.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A utility company is assessing its security program. The company's core value is 'reliability and public safety.' The assessment finds that the current program is compliant with regulations but lacks proactive threat hunting. The company is facing increasing cyber threats from nation-state actors. The leadership is risk-averse and prefers incremental changes. What should the security team recommend?

   • AOutsource threat hunting to a managed security service provider to avoid internal disruption.
   • BImmediately implement a 24/7 threat hunting team to address the nation-state threat.
   • CPropose a pilot threat hunting program with clear metrics and a phased rollout, aligned with the company's reliability value.
   • DMaintain the current compliance-focused program because it meets regulatory requirements.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A healthcare nonprofit's security program assessment reveals that the organization's core value of 'patient privacy above all' conflicts with a proposed security analytics tool that would collect and analyze patient data for threat detection. The board asks the security team to reconcile this tension. What should the security team do?

   • AImplement the tool but restrict data collection to metadata only, avoiding direct patient identifiers.
   • BConduct a privacy impact assessment and configure the tool to use de-identified data, then present the trade-off to the board for a decision.
   • CProceed with the tool as planned because security monitoring is a legal requirement for healthcare organizations.
   • DReject the tool outright because it conflicts with the organization's core value.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A startup's core values include radical transparency and employee autonomy. The security team is analyzing the program and finds that employees have access to almost all company data. The company is planning to raise a funding round that will require compliance with investor security requirements. What is the best way to align the security program with the company's values?

   • AImplement strict access controls without explanation to move quickly
   • BImplement role-based access controls and explain the need for data protection to employees
   • CMaintain open access to all data to preserve transparency
   • DAsk employees to voluntarily limit their own access to data
   Reveal Solution Discussion Select an answer first